73871b23cd91535cffca6136b3f962856d3c3b4a176b47b7249f1393c36e3afc

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d6977039b2c8badb230d2ce7a4c960e2.html
Size

28KB
MD5

d6977039b2c8badb230d2ce7a4c960e2
SHA1

03f66c00281d05a87106ef8cae8670b0387d1018
SHA256

73871b23cd91535cffca6136b3f962856d3c3b4a176b47b7249f1393c36e3afc
SHA512

27dee0225e72ef46f6318ae8a1a4439ce690f4e4e515914dd27fa950a6f74c0e9c100ef4fc3d62245e1b897020aa2e2953b590d29eaca6ca0222dbe6c6b59440
SSDEEP

192:uwjUb5n0HSinQjxn5Q/SnQiexNnvnQOkEntqMnQTbnVnQ9exCam6A79K6BQl7MBq:IQ/nQzm9KjSq

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000002494e1221e7918cf15bd3a741374e6e7ea60356e2a2c0dd2a27f92764c2d27dd000000000e8000000002000020000000f574e140f278571f93cdc297d44b1daf9499a44772b332a2c83e670d20ff7df990000000135581ea072868c95ebf5dd863ead75d324051fb65231270eec57709a28099a0ff242b8e2a7918ac846bd6dd43325a26c99c8dd777fecdf6c2403fd2ff28ce609042a939c716f202d61c020b0d672b2bcc9d3dcc50b943f1b63412fb9c915dc2c17890b7b1eb2ddd80f0f7913271cd4f5f78e0674a000899978889e465a276c8fe5cae3a4b56729d5cb37189ac8e5a694000000059f9661b2fc3b8077d858e13ec8a33326c52b866350cba14993e719025cd988cc1156542652d5066b8a810b1545d4e861ff1bb607e05b3339773009e93992419	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a05ede3d1b7ada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64FB1821-E60E-11EE-85E5-5A791E92BC44} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009d182698a4727943a65bc6c9ecfd0fc5000000000200000000001066000000010000200000005209639975e81f1e1ce8847ba3608d7948656f660760d59063171755948bf2fc000000000e80000000020000200000005f062d9dfe93e8dc22b58d03328734635cc23d659d8cbf5f7ebe8e892f9e8c74200000004ab8e788d6d7c07e13e29a618503d43befbd3df8c3f38d5a4f9e60efa78b24fd4000000074b9fb378fb06388a4646d032199c763a50735b96450ef3375101adb3854f6e82c67bb3707fcad50a161db1ee3ad87bfc068f3cab124783f16860a86653eec79	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "417027869"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2532	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2176	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2176	iexplore.exe
2176	iexplore.exe
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE
2532	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2532	2176	iexplore.exe	28
PID 2176 wrote to memory of 2532	2176	iexplore.exe	28
PID 2176 wrote to memory of 2532	2176	iexplore.exe	28
PID 2176 wrote to memory of 2532	2176	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d6977039b2c8badb230d2ce7a4c960e2.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2176 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
67KB

MD5
753df6889fd7410a2e9fe333da83a429

SHA1
3c425f16e8267186061dd48ac1c77c122962456e

SHA256
b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

SHA512
9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
40eab00bf1e91097c3b63b77ba17333c

SHA1
1f5046fc2437c6a9fcd672d4f27898cbd1ae0736

SHA256
f6d82fb663778e04476e298f95595528fd696988bd65e222d846ae88cf37fe63

SHA512
b96c0bce46972e02c6f83d2520dd4ec8a9e8dbc63c9c3c6b78f4090b54bc290af71b231ebd7b7bbc6c0c3d898dc40b095db25548304ceeacf67898f74e77aa97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f46a0d2a9e2851a6a18a1278fcdb22fe

SHA1
73faf887dc1abefe73bf653437cb5358e38a7b11

SHA256
67327d6368c1a13856086d647536fbd43888a9a9bda66afd7c39af1fc5ba1903

SHA512
46548d092e9bd1ebf94a6fd6a32f348d0b833126834a3e78e1a563f0698a0a3334edcf8890d0c3704ecca6d66fc26b7edc1cf4ae5d052a23f8ed7ca7495690b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
23ab87a8c04538685fc6560d5b36e03a

SHA1
5698a610089b5da02e1d695231b37e550011e8fc

SHA256
424c5232b00f3df1eea8c7d5729018da7c88d0bba2c551dd12202501a98a55b4

SHA512
219a3e6906304a3596c37c003cf81aebf894521320d4a44115d32e1a09946fa69496e85b202f804ec7bfaa7213d98586e0d046cee2425e67f406dc4f34ef58b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c0f95cddc86070d45a942dda0d6eaf27

SHA1
bcf165a511059e93b568779f589d468d7d90d0cd

SHA256
d997b786d562f7cd7c59ed1013e4ffdfb8813d609f84c6f2e424480a01a6f84b

SHA512
88cbdad5a4f6ceda547fcc84f951a91922f2e8bd79a76148b0506134f471e4a6a3893a9fd630b445893c6fa28c2278ad18c46531a7379caac402997f94f9d952

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
13eb927a2147bd1c61a39ac67fd5c6cd

SHA1
b2d7d7b04dec7953fd5f8d9602f146ec96de2316

SHA256
2883094d3d09191918d48eec954bb997e932a4e91262a1879dd5026db786cc9a

SHA512
2d7a50ee12f79d8de2434ed7e93b6e0d78be35ecd6cd30d79e7e782bdcfcbea09c73c6ed6dd1e667f993d5dd363cc58cf0ba4f707af19d9e7d983f25a97dd8b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
188442de6e48a766279e35ecc47fd699

SHA1
e1db80f3419771b3054a340908a260734a63cf87

SHA256
a12ca626d2d49cf3c2e7beba78261cb13b44e9505fc4d6257dc575c7bccbbcf5

SHA512
74fc89be4bc19958827c8bb6cf2e8e13202dad0091a8ccf9ac12c344ac487492a3dbaf6df5124cb605841ca607149027d2e20d4d51f3b9fbcb1d2b9b73753043

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
70d0cfe0892e8c57807b174a732921c4

SHA1
94ffc0f01c5d3e95726d967b4d25bb6f65a83e24

SHA256
cf4e755ff5e088e0f4f58e6078b764190c11629dc5ba08354564a297eaca4ea0

SHA512
b28844369e49defe195aff7269738b0dc6f255c86385e4e8cb2749f18afdeef30da25cb28604e0f509bfb06d700039f265a7247cf18c6d6c3858b4d0a920228a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
baa7f2b9c379060731d41294d76df33b

SHA1
6ff48b3103bdf921660a540df421328eab887006

SHA256
da75ac8dc86468b5a953df2c5c81b49563d7bbb1c695d5dd9b4ef15fd568467e

SHA512
ef286c5242939f6d7aa753e99ef0aeae4712d6762649a4c1c6038ea5aff6e576e556f03ae517a360296cc02ba2d629c91da145e8d1619ee82afe349ed4eea14b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
6e76e9ba8b51014890677b4f17ccc519

SHA1
ec2f199fb7122135ae6d0f5e4fc325d90cb15219

SHA256
d66c547321f5f6d1a717556a54ef57497509839de979460af7db85fdd7302255

SHA512
e09ffdd83b1750555516d6b0010b3178a8c98894d8d16ce761305e9bc567e5bb116930643c758b5b769b23c36070538d0848680f3ed711bc95b53ba885089437

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
271533a0f50dcd8476edd5823d4544da

SHA1
d3e049c3ae2cc815ea3505b2810a1e81ef9bf48d

SHA256
6af1f636ec438c28671395bd07cd080c15044b90db59f71e836e2312a1e16040

SHA512
15d1c223c41f9c2116feb57dc83894f83bb1778399e31a91ca1b62f67033e459e72127d3e6b81b0815e11e23287a8ff0b1250b85589c6d94757f4d336ae5d6a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eceecd7ba037494790e69ec7ec7040a5

SHA1
4f06c557deb139f597117226f0073293ef0e87db

SHA256
149c71cc62bcf11d0ad701ac99492fc76512c7e1e7dca85d9128968468754712

SHA512
7ca68d1e6d6bbbafb4fa1a09b113dbd36c51d4b687f24679ce5d2b868bd69a924b94c67902ae01e59deb83a229ddf5f558410ef5814fd893374050c39810b8cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
94aca29ae7ab04959ad941a8c73382e4

SHA1
bcc03597195482452f677c4b31487d8a94e1e9b2

SHA256
571dd3135d64840f8ee6a4df3c632c1daf33a3a5c95878a3b0d7988bb609cd01

SHA512
1b81655e6bbae4a55c190bab102c002409f4e00965af07c9cf80bd74be5497dc7e0f1f7bd42a872622975fe599d85febacbe74842ab6246466835656a7d27b2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
bdf1c95512d9233d646f5186aa05525a

SHA1
83a8ec67912d301ad712e8881b9af787bd604caa

SHA256
a6684d8ac869889f79af28a7ed3f92c85a7cf5a1a42621257daae2bc6efbc2a5

SHA512
2a2e141f73b73b790c08f32762f4c021d6a5cca784850b5cd8474b18eed4407e5f42c7304b6abb54fbcea56bcfd54d7f8f967a581d76519368384a7595de5eea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91E5.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9393.tmp

Filesize
175KB

MD5
dd73cead4b93366cf3465c8cd32e2796

SHA1
74546226dfe9ceb8184651e920d1dbfb432b314e

SHA256
a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

SHA512
ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

Download Submit